Fictitious example. ACME Embedded GmbH, its products, records and document IDs are invented for illustration. Use this as a structural model, not as a template to adopt unchanged — and not as legal advice.
LEG-LST-002 — Software Licence Whitelist
| Document ID | LEG-LST-002, rev. 4 (living list) |
| Owner | Managing Director, advised by external counsel; maintained by the Product Security Lead |
| Approved by | Managing Director — each change to a category |
| Reference | SDL-POL-005 §2(3) (licence compatibility as a knock-out criterion); CRA Annex I Part II item 1 (SBOM) — the licence field is only meaningful if it is checked |
| Applies to | Every third-party and open-source component shipped in an ACME product or companion tool |
| Review | Annually, and whenever a component is proposed under a licence not on this list |
1. What this list decides
A licence question at component-selection time is a five-minute lookup. The same question after the component is designed into a shipping product is a legal review, a possible re-implementation, and a delayed release.
So this list exists to be consulted before the evaluation form in SDL-POL-005 Annex A is submitted, and to give three unambiguous answers: yes, ask counsel, or no.
One embedded-specific point drives most of the list. ACME ships statically linked firmware images. Licences whose obligations are satisfied by dynamic linking — the LGPL family in particular — impose a relinking obligation that a signed, anti-rollback-protected firmware image cannot honour without handing users the means to build and install their own image, which conflicts directly with the update integrity required under SDL-STD-025. That tension is a licensing decision, not a legal footnote.
2. Categories
2.1 Approved — permissive (use freely, attribution required)
| Licence | Note |
|---|---|
| MIT | |
| BSD-2-Clause, BSD-3-Clause | |
| Apache-2.0 | Carries an express patent grant — preferred where a choice exists. Incompatible with GPL-2.0-only; relevant on Linux-based targets |
| ISC | |
| Zlib / libpng | |
| BSL-1.0 |
Obligation in all cases: the licence text and copyright notices are delivered with the product. ACME satisfies this through the notices file generated from the SBOM and shipped in the user documentation, plus a copy on the product support page.
2.2 Conditional — requires PSL and counsel approval before selection
| Licence | Condition |
|---|---|
| MPL-2.0 | File-level copyleft. Acceptable where the component is used unmodified. Modifications to MPL files must be published — the decision is whether we accept that obligation for this component |
| LGPL-2.1, LGPL-3.0 | Only with dynamic linking. Statically linked into firmware, the relinking obligation cannot be met without undermining signed updates. Default answer for firmware: no |
| EPL-2.0 | Acceptable for tooling; assess for shipped code |
| Dual-licensed (GPL + commercial) | Acceptable only with the commercial licence purchased and CON-CLS-007 attached |
| SIL Open Font Licence | Fonts in companion tools only |
2.3 Prohibited for shipped code
| Licence | Reason |
|---|---|
| GPL-2.0, GPL-3.0 | Strong copyleft over the whole firmware image. GPL-3.0 additionally carries anti-tivoisation terms incompatible with locked secure boot |
| AGPL-3.0 | Network copyleft; reaches our backend |
| SSPL, BUSL, Elastic Licence | Source-available, not open source; field-of-use restrictions |
| Non-commercial, "no evil", research-only | Not usable in a commercial product |
| No licence stated | The default is "all rights reserved". An unlicensed component is not free to use, however public the repository |
Exception: GPL-2.0 components that are part of the Linux distribution on the Gateway G50 and are neither modified nor statically linked into ACME code are permitted under the standard distribution model, with the written offer for source honoured on the support page. This exception is narrow and does not extend to the S300 firmware image.
3. How the list is used
- The developer looks the licence up here while completing the SDL-POL-005 Annex A evaluation form.
- Approved → proceed. Conditional → obtain PSL and counsel approval before the form is submitted; the approval is attached to it. Prohibited → the component fails the SDL-POL-005 §2(3) knock-out; select an alternative.
- A licence not on this list is escalated to the PSL, who obtains a counsel opinion and adds it to a category. Nothing proceeds on the assumption that an unlisted licence resembles a listed one.
- The licence recorded in the component registry and in the SBOM is the licence of the version pinned. Licences change between releases, and a re-licensed upstream is a change that has to be caught at upgrade, which is why the check repeats at every version bump.
4. Obligations ACME must actively discharge
| Obligation | How it is met |
|---|---|
| Attribution and licence texts | Notices file generated from the SBOM; shipped with user documentation and published on the support page |
| Written offer for source (GPL-2.0, G50 exception) | Published on the support page, honoured for the support period |
| Modified-file publication (MPL-2.0) | Modified files published in ACME's public repository; the component registry flags which |
| Patent-grant awareness (Apache-2.0) | Recorded in the evaluation form |
| No obligation may outlive the record | Notices and offers retained for the support period plus 10 years |
5. Records
The evaluation forms with their licence determinations, counsel opinions for conditional approvals, the generated notices files per release, and this list's revision history. Quality records.
Revision history
| Rev | Date | Change | Approved |
|---|---|---|---|
| 2 | 2025-06-11 | Categories introduced; SSPL/BUSL added as prohibited | MD |
| 3 | 2026-01-22 | G50 Linux distribution exception added with written-offer procedure | MD |
| 4 | 2026-07-18 | LGPL restricted to dynamic linking with the static-firmware rationale stated; "no licence stated" made explicitly prohibited; re-check at version bump added | MD |